Re: [Bitcoin-development] Instant / contactless payments

[Andreas Schildbach <andreas@schildbach.de>]

On 03/07/2014 10:26 AM, Johannes Zweng wrote:

>     In current phone implementations, the screen must be on already for NFC
>     to be active. Also it must be unlocked, although I certainly hope future
>     OSes will allow payment apps on the lock screen, just like they allow
>     music players.
> 
> Just a small input to this point:
> On Android 4.4 the new host card emulation (HCE) feature (aka: the phone
> emulates a ISO-DEP Smartcard and processes ISO7816-4 APDU commands like
> a Smartcard would do) only works when the display is on, but even when
> the screen is locked (can be changed with "android:requireDeviceUnlock"
> in Manifest). See here for detailled
> specification: http://developer.android.com/guide/topics/connectivity/nfc/hce.html
> 
> Using the HCE API on Android 4.4 also has the beauty that any app that
> registers itself for HCE and sets its category to CATEGORY_PAYMENT in
> the Manifest automatically shows up in Adroid's system settings under
> "Tap & Pay" (where a user would expect payment applications).

Thanks for the pointer! Good to hear there is finally a decent
documentation for HCE.

Good news: HCE offers the required dispatch ability -- they call it AID
(Application ID).

Bad news: It seems - at least CATEGORY_PAYMENT - very credit card centric.

HCE seems to cover only the payer side. I wonder if there is also an API
for "reader emulation" which we would need for apps to support the payee
side.

Since Android 4.4 market penetration is quite far off, I suggest we
focus on the already established NFC payment protocol(s) for now, it
works pretty well. I will investigate into IsoDep and HCE and see if we
can make it enhance usability.

Interesting side note: They recommend messages transmitted via NFC to
not exceed 1 KB in order for a snappy experience. This (again) questions
usage of bulky X.509 certificates in our payment request messages.
Bitcoin Wallet currently does not sign payment requests, so I could not
try how it would feel.